How secure is Shamir's Secret Sharing for password sharing when attacker has t-1 shares?

Question

I am designing protocol to share a random generated n long password between k parties using Shamir's Secret Sharing. I know that share alone does not reveal much information about the original password to the attacker except for the size of password. My solution now is to extend each password to 512 bits using constant pattern.

How secure is this against brute-force attack when attacker has t-1 shares and knows the stretching pattern? Is there any better way to obfuscate the original password size? Would it be better to encrypt the password with symmetric cipher let's say AES256-CTR and random key K and then split that key with SSS algorithm?

Answer 1

Shamir secret sharing is information theoretically secure. This holds as long as the attacker knows fewer than $t$ shares. So, even with $t-1$ shares, the attacker still knows nothing about the secret. So a brute force attack given $t-1$ shares is impossible, even an attacker with infinite computing resources could not brute force the secret.

Using a deterministic (yet known to the attacker) transform on the secret to get it to be 512 bits, then secret sharing that value is just fine for protecting the length of the secret.

Yes, you could encrypt the secret with a symmetric cipher like AES-256, though you still have to pad the secret to hide the length. Then you could share the encryption key with SSS. This does lose information theoretic security, however, as AES is not information theoretically secure. In practice I don't believe this to be a major issue, however.